O365OrgSettings - failure setting PlannerAllowCalendarSharing

[salbeck-sit]

Description of the issue

Updating this parameter is done via a REST-call to tasks.office.com/taskAPI/tenantAdminsettings/Settings
It currently fails with a permissions issue. From the meager documentation I can find, Microsoft states that 'you need to be a global admin'.
The SPN used includes all the scopes that the settings.json file contains. Can someone shed some light on this ?

Microsoft 365 DSC Version

1.25.205.1

Which workloads are affected

Office 365 Admin

The DSC configuration

O365OrgSettings "O365OrgSettings"
        {
            ApplicationId                                         = <appId>;
            CertificateThumbprint                                 = <thumbprint>;
            IsSingleInstance                                      = "Yes";
            PlannerAllowCalendarSharing                           = $False;
            TenantId                                              = <tenantId>;
        }

Verbose logs showing the problem

VERBOSE: [S000077]: LCM:  [ End    Test     ]  [[O365OrgSettings]O365OrgSettings]  in 22.1830 seconds.
VERBOSE: [S000077]: LCM:  [ Start  Set      ]  [[O365OrgSettings]O365OrgSettings]
VERBOSE: [S000077]:                            [[O365OrgSettings]O365OrgSettings] Updating the Planner Allow Calendar Sharing setting to {False}
The remote server returned an error: (403) Forbidden.
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:) [], CimException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand
    + PSComputerName        : localhost

Environment Information + PowerShell Version

OsName               : Microsoft Windows Server 2019 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 1809
WindowsBuildLabEx    : 17763.1.amd64fre.rs5_release.180914-1434
OsLanguage           : en-US
OsMuiLanguages       : {en-US}

Key   : PSVersion
Value : 5.1.17763.6766
Name  : PSVersion

Key   : PSEdition
Value : Desktop
Name  : PSEdition

Key   : PSCompatibleVersions
Value : {1.0, 2.0, 3.0, 4.0...}
Name  : PSCompatibleVersions

Key   : BuildVersion
Value : 10.0.17763.6766
Name  : BuildVersion

Key   : CLRVersion
Value : 4.0.30319.42000
Name  : CLRVersion

Key   : WSManStackVersion
Value : 3.0
Name  : WSManStackVersion

Key   : PSRemotingProtocolVersion
Value : 2.3
Name  : PSRemotingProtocolVersion

Key   : SerializationVersion
Value : 1.1.0.1
Name  : SerializationVersion

[salbeck-sit]

Same response using DEV (1.25.212.1)

[salbeck-sit]

Retried with SPN assigned role Global Admin - no change